How can I authenticate users from Google Apps on internal web application?

I开发者_运维知识库 was wondering what is the best way to authenticate a Google Apps user in an internal web application?

I do not need to access their data like the two-legged authorization seam to do. I just want a user to use an internal application using their Google Apps credential.

You can use Google Apps as an OpenID provider and the hosted accounts for identity by using OpenID API. This is also known as federated login. Your internal application then becomes an OpenID relying party.

You need to first enable OpenID from your Google Apps control panel - http://www.google.com/a/cpanel/your-domain/SetupIdp

More details here - http://code.google.com/googleapps/domain/sso/openid_reference_implementation.html